【软件名称】flashtools
【加密方式】注册码
【破解工具】OD,PEID
【破解平台】winxp
【解密过程】
软件是用UPX加的壳,很容易脱的,省略...
验证注册码的方式是重新启动验证.ini文件,输入注册码后并不立刻进行注册码的验证,而是把注册信息下进注册文件Reg.ini中(它不通知你注 册码是下次重新启动比较的),等下次重新启动软件的时候进行比较注册成功是否,所以输入注册码后,重新启动软件下断
bpx GetPrivateProfileStringA
停在这里:
0044C098 E8 C3A6FBFF CALL
0044C09D 8BC8 MOV ECX,EAX ; EAX为读取regcode 的位数
0044C09F 8D95 00F8FFFF LEA EDX,DWORD PTR SS:[EBP-800] ; regcode
0044C0A5 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0044C0A8 E8 437CFBFF CALL 1_.00403CF0
跟一下到这里:
0044C7E8 53 PUSH EBX
0044C7E9 56 PUSH ESI
0044C7EA 57 PUSH EDI
0044C7EB 33C0 XOR EAX,EAX
0044C7ED 55 PUSH EBP
0044C7EE 68 C9C84400 PUSH 1_.0044C8C9
0044C7F3 64:FF30 PUSH DWORD PTR FS:[EAX]
0044C7F6 64:8920 MOV DWORD PTR FS:[EAX],ESP
0044C7F9 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
0044C7FC A1 B4BB4600 MOV EAX,DWORD PTR DS:[46BBB4]
0044C801 8B00 MOV EAX,DWORD PTR DS:[EAX]
0044C803 E8 BCC1FFFF CALL 1_.004489C4
0044C808 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0044C80B 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
0044C80E E8 D1BFFBFF CALL 1_.004087E4
0044C813 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0044C813 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0044C816 BA E4C84400 MOV EDX,1_.0044C8E4 ; ASCII "Reg.ini"
0044C81B E8 7076FBFF CALL 1_.00403E90
0044C820 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
0044C823 B2 01 MOV DL,1
0044C825 A1 90B94400 MOV EAX,DWORD PTR DS:[44B990]
0044C82A E8 09F2FFFF CALL 1_.0044BA38
0044C82F 8BD8 MOV EBX,EAX
0044C831 6A 00 PUSH 0
0044C833 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0044C836 50 PUSH EAX
0044C837 B9 F4C84400 MOV ECX,1_.0044C8F4 ; ASCII "RegCode"
0044C83C BA 04C94400 MOV EDX,1_.0044C904 ; ASCII "Reg"
0044C841 8BC3 MOV EAX,EBX
0044C843 8B30 MOV ESI,DWORD PTR DS:[EAX]
0044C845 FF16 CALL DWORD PTR DS:[ESI]
0044C847 8BC3 MOV EAX,EBX ; 返回到这里
0044C849 E8 AE66FBFF CALL 1_.00402EFC
0044C84E 33C0 XOR EAX,EAX
0044C850 55 PUSH EBP
0044C851 68 76C84400 PUSH 1_.0044C876
0044C856 64:FF30 PUSH DWORD PTR FS:[EAX]
0044C859 64:8920 MOV DWORD PTR FS:[EAX],ESP
0044C85C 8D4D F8 LEA ECX,DWORD PTR SS:[EBP-8]
0044C85F BA 10C94400 MOV EDX,1_.0044C910 ; ASCII "lovejingtao"
0044C864 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; regcode
0044C867 E8 E4FDFFFF CALL 1_.0044C650 ; 这里是计算注册码过程
0044C86C 33C0 XOR EAX,EAX
0044C86E 5A POP EDX
0044C86F 59 POP ECX
0044C870 59 POP ECX
0044C871 64:8910 MOV DWORD PTR FS:[EAX],EDX
0044C874 EB 0A JMP SHORT 1_.0044C880
0044C876 ^E9 ED6AFBFF JMP 1_.00403368
0044C87B E8 446EFBFF CALL 1_.004036C4
0044C880 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
0044C883 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; CPUID
0044C886 E8 A5BAFBFF CALL 1_.00408330&